Workload Identity Federation Github Actions Authentication

What Workload Identity Federation with Attribute Filtering Is

Workload Identity Federation enables external workloads—such as GitHub Actions CI/CD pipelines—to securely exchange external ambient credentials (such as an OpenID Connect token) for short-lived Google Cloud access tokens. By configuring a Workload Identity Pool, an OIDC Provider, and defining precise attribute mappings and attribute conditions, you establish identity federation without generating, distributing, or rotating static, long-lived service account JSON keys.

How It Meets the Requirements

• Eliminating long-lived service account keys: GitHub Actions requests a short-lived OIDC ID token at runtime and exchanges it directly with the Google Cloud Security Token Service (STS) to impersonate a Google Cloud Service Account, ensuring keyless authentication.
• Preventing unauthorized external repositories: Configuring an attribute condition (for example, assertion.repository_owner == 'my-org' or checking specific repository paths) ensures that GitHub ID tokens issued to external tenants or untrusted repositories are rejected during the token exchange.
• Enforcing least privilege: Granting the roles/iam.workloadIdentityUser role on the specific service account to a targeted federated principal (e.g., principal://iam.googleapis.com/.../subject/repo:my-org/my-repo:... or an attribute-mapped subject) rather than opening it to an entire pool prevents lateral privilege escalation.

Key Advantages

• Eliminates credential management overhead: Removes the risk of compromised static service account keys in repository secrets or developer environments.
• Granular authorization policies: Enables IAM policies to evaluate claim attributes such as repository, branch, actor, and environment.
• Native OIDC token exchange: Uses the GitHub Actions OIDC discovery endpoint (https://token.actions.githubusercontent.com) and standard JSON Web Key Set (JWKS) validation.
• Auditability and non-repudiation: Cloud Audit Logs capture external token exchanges and service account impersonation events with attribute fidelity.

Why This Is Optimal

This approach aligns with Google Cloud's official security best practices for federating multi-tenant external identity providers. Attribute conditions provide strict boundary enforcement against multi-tenant spoofing risks while fully automating secure, short-lived credential issuance directly inside CI/CD workflows.